Expose identity-bound awaited host admission for native Remote input

[eightbitreaper]

Feature request

Please expose and document a supported host admission contract for native Remote-origin input that combines runtime-attested input identity with an awaited allow/deny/hold decision before the relevant history persistence, model dispatch and effects.

This is a public API-contract request, not a newly reproduced runtime failure or a claim that current hooks provide this guarantee. It is also separate from owner-connection/RPC transport failures.

Public versions and evidence

• Released SDK: v1.0.13, commit f13e4a2cc7e4e220974d2333142234e162a3252e.
• Public main examined: f45c46fd1812f8bed5b4cbc250f47177c83068f0; comparison from the release.
• Submitted-hook documentation at that revision does not provide the required explicit rejection contract.
• Experimental authorization events describe message/effect authority and replay after a turn is read. They are not a documented identity-bound pre-input barrier.

Caller-supplied MessageOptions.source, turn indexes, timestamps, text-derived IDs, mutation-only hooks and unawaited event observers do not establish the requested combination. Throwing from a callback is not a substitute for documented fail-closed semantics.

Minimal contract demonstration

Using the published hook types, dispatch semantics and submitted-hook documentation above, a host cannot express a supported identity-bound rejection that is guaranteed to run before both history/model admission and effects for a native Remote-origin message. Later authorization records necessarily reference an already-read message. No live accounts, private prompts or runtime traces are needed to demonstrate this interface gap.

If a supported API already provides this, please identify its exact version, schema, ordering guarantees and Remote-origin example.

Requested acceptance criteria

1. Runtime-attested principal/origin, source session and generation, plus stable original root message/event and causal identities that remain consistent across reconnect. Caller-provided provenance labels must not be treated as authentication.
2. An explicitly awaited host decision before the documented persistence/model/effect boundaries, including auxiliary model activity. Please identify whether the guarantee covers remote/cloud persistence, local persistence, or only source-side dispatch. A source callback must not imply that GitHub has not already received the input.
3. Explicit denial, malformed responses, timeout, exception, missing owner and disconnect produce typed non-success and prevent the covered downstream actions. No swallowed-exception or unawaited-observer success path.
4. Real native Remote positive and negative/spoofed/replayed cases use the same admission path. Reconnect preserves decisions and identities without duplicate model/tool/history effects; distinct equal-text turns remain distinct.
5. Publish supported CLI/SDK version pins, ordering tests and an example retaining ordinary allowed custom-tool/permission handling after admission.

Important separation

Awaited custom-tool and permission handlers are useful for controlling effects after input. This request is for the earlier admission boundary; it does not propose weakening existing permission checks. Likewise, fixing a transport problem, selecting a different model or enabling BYOK is not by itself evidence about cloud intake, account visibility or data retention.